All Apps and Add-ons

evtsys to syslog for windows events

coreyf311
Path Finder

collecting windows logs using evtsys and forwarding to a syslog server. I have a UF installed on the universal forwarder reading the windows logs created by evtsys. I have tried using sourcetype=WinEventLog:Security but the logs do not match what I see in the samples directory from the Splunk_TA_windows apps so these events are not extracted per the app. Is there a TA or sourcetype i can use to get evtsys logs parsed correclty? trying to avoid a custom props/transforms from scratch to parse all this data.

Tags (1)
0 Karma

efika
Communicator

Did you manage to find a solution other than writing your own props/transforms ?

0 Karma

FrankVl
Ultra Champion

Can you perhaps share a few sample logs, for those of us not familiar with evtsys? Perhaps someone recognizes it as a format that is supported by some Splunk add-on or one of the sourcetypes supported by Splunk TA Windows (perhaps it looks like snare logs?).

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...